Static task
static1
Behavioral task
behavioral1
Sample
unlockfps_clr (1).exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
unlockfps_clr (1).exe
Resource
win10v2004-20231025-en
General
-
Target
unlockfps_clr (1).exe
-
Size
1.4MB
-
MD5
6ae7e63ada5b5f911c1f927c06945674
-
SHA1
4998ba01933d9c32f3710be1eb0393af7ae7cad4
-
SHA256
cbe404e97faa75d2aafbfff617c4ed980e1948cbcab17fe6b7f18544f8165e73
-
SHA512
363fb39c87cf8e00668f81519f11f57ba162728b0867d049af9f71d29e370261a3834ebcbf47fe0c1ab6825edffa206cb5dc0eb1266ba10e035c168bdd52f8be
-
SSDEEP
24576:BqNhDeUbkfiBBmJMqTfOB0YAskD72dowc/PyQCqvhK1Aay9ZOMEY/+ejjz1uTau7:BqNhDeUbkfiBBmJMqTfOB0YAskD72do4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unlockfps_clr (1).exe
Files
-
unlockfps_clr (1).exe.exe windows:6 windows x64
b02527c23ab2fc907f481adfb3c43fc1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetPriorityClass
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
OpenProcess
QueryFullProcessImageNameA
TerminateProcess
FormatMessageA
LocalFree
CreateProcessA
GetLastError
K32EnumProcessModules
K32GetModuleBaseNameA
K32GetModuleInformation
VirtualAlloc
VirtualFree
VirtualAllocEx
GetModuleHandleA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
ReleaseMutex
CreateMutexA
OpenMutexA
LockResource
LoadResource
SizeofResource
FindResourceA
user32
GetSystemMetrics
LoadImageA
SetWinEventHook
MessageBoxA
GetWindowThreadProcessId
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_cexit
abort
terminate
vcruntime140
memset
__std_exception_copy
memmove
__std_exception_destroy
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
__FrameUnwindFilter
__CxxFrameHandler3
_CxxThrowException
__current_exception
__CxxQueryExceptionSize
__current_exception_context
__CxxExceptionFilter
memcpy
msvcp140
_Thrd_sleep
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
_Xtime_get_ticks
api-ms-win-crt-math-l1-1-0
ceilf
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nep Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ